Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting WMI Persistence · mukul975 | DecimalAI

Detecting Wmi Persistence

SkillScore32Maintained

detecting-wmi-persistence

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-wmi-persistence/SKILL.md

decimalai skills pull detecting-wmi-persistence --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-wmi-persistence/SKILL.md https://app.decimal.ai/s/detecting-wmi-persistence/SKILL.md

Raw file: /s/detecting-wmi-persistence/SKILL.md ↗ · machine-readable summary at /s/detecting-wmi-persistence.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+22% tokens0% turns32% of whole cases pass with skill (7/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-wmi-persistence/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Detecting WMI Persistence

When to Use

When hunting for WMI event subscription persistence (MITRE ATT&CK T1546.003)
After detecting suspicious WMI activity in endpoint telemetry
During incident response to identify attacker persistence mechanisms
When Sysmon alerts trigger on Event IDs 19, 20, or 21
During purple team exercises testing WMI-based persistence

Prerequisites

Sysmon v6.1+ deployed with WMI event logging enabled (Event IDs 19, 20, 21)
Windows Security Event Log forwarding configured
SIEM with Sysmon data ingested (Splunk, Elastic, Sentinel)
PowerShell access for WMI enumeration on endpoints
Sysinternals Autoruns for manual WMI subscription review

Workflow

Collect Telemetry: Parse Sysmon Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventConsumerToFilter).
Identify Suspicious Consumers: Flag CommandLineEventConsumer and ActiveScriptEventConsumer types executing code.
Analyze Event Filters: Examine WQL queries in EventFilters for process start triggers or timer-based execution.
Correlate Bindings: Match FilterToConsumerBindings linking suspicious filters to consumers.
Check Persistence Locations: Query WMI namespaces root\subscription and root\default for active subscriptions.
Validate Findings: Cross-reference with known-good WMI subscriptions (SCCM, AV products).
Document and Remediate: Remove malicious subscriptions and update detection rules.

Key Concepts

| Concept | Description | |---------|-------------| | Sysmon Event 19 | WmiEventFilter creation detected | | Sysmon Event 20 | WmiEventConsumer creation detected | | Sysmon Event 21 | WmiEventConsumerToFilter binding detected | | T1546.003 | Event Triggered Execution: WMI Event Subscription | | CommandLineEventConsumer | Executes system commands when filter triggers | | ActiveScriptEventConsumer | Runs VBScript/JScript when filter triggers |

Tools & Systems

| Tool | Purpose | |------|---------| | Sysmon | Windows event monitoring for WMI activity | | WMI Explorer | GUI tool for browsing WMI namespaces | | Autoruns | Sysinternals tool listing persistence mechanisms | | PowerShell Get-WMIObject | Enumerate WMI event subscriptions | | Splunk | SIEM analysis of Sysmon WMI events | | Velociraptor | Endpoint WMI artifact collection |

Output Format

Hunt ID: TH-WMI-[DATE]-[SEQ]
Technique: T1546.003
Host: [Hostname]
Event Type: [EventFilter|EventConsumer|Binding]
Consumer Type: [CommandLine|ActiveScript]
WQL Query: [Filter query text]
Command: [Executed command or script]
Risk Level: [Critical/High/Medium/Low]
Recommended Action: [Remove subscription, investigate lateral movement]

Illustrative Want to see what detecting-wmi-persistence would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 02:20 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+32%

32% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+22%

1,637.62 vs 1,339.24

fail → pass · 7fail → fail · 15

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 As part of a purple team exercise on endpoint `DESKTOP-HR77`, we are analyzing WMI persistence artifacts. Conduct the assessment and summarize your findings following our hunt report fields: Hunt ID, Technique, Host, Event Type, Consumer Type, WQL Query, Command executed, Risk Level, and Recommended Action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 During an incident response investigation on host `APP-SRV-04`, we gathered raw endpoint telemetry indicating a potential event subscription setup. Please process these findings and output a formal hunt report detailing the Hunt ID, technique identifier, hostname, event type, consumer classification, WQL query text, command payload, risk severity level, and recommended response action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When manually auditing persistent auto-start locations and WMI event subscriptions on a suspected host without running CLI scripts, which Sysinternals utility displays persistent WMI subscriptions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 In a WMI persistence investigation, an analyst has found five distinct event filters and three event consumers. What specific artifact binding must be evaluated next to confirm which filter triggers which consumer?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 To complete our Sysmon WMI monitoring rule set, we need the event code that captures the binding action linking an event consumer to an event filter (WmiEventConsumerToFilter). What is the exact Sysmon Event ID for this binding activity?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 A responder needs to script an endpoint query via PowerShell to inspect active WMI event filters in the root\subscription namespace on Windows hosts. Which built-in PowerShell cmdlet is standard for WMI object enumeration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We are tagging threat hunting alerts for WMI Event Subscription persistence. Many analysts use the broad parent technique identifier T1546 or T1059. What is the specific MITRE ATT&CK sub-technique ID for WMI Event Subscription?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An analyst filling out a threat hunt report entered 'WmiEventFilterCreation' in the Event Type field. Which exact allowed string from the standardized hunt template should be used in the Event Type field when documenting a filter creation event?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When writing detection signatures for new WMI event consumers (WmiEventConsumer) in endpoint logs, telemetry engineers often default to monitoring generic process creation (Event ID 1). What specific Sysmon Event ID directly tracks WmiEventConsumer creation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We detected an unauthorized key added to HKCU\Software\Microsoft\Windows\CurrentVersion\Run on endpoint HOST-FIN-02 during routine monitoring. Please provide an incident summary report detailing the persistence technique, affected registry path, registry value data, and recommended mitigation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A security operation center analyst detected new Windows service creation running an unquoted service path executable on host APP-WEB-09. Summarize the threat analysis including service name, binary path, startup type, and remediation steps.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We recently received an alert on workstation `WIN-EXEC-902` regarding suspicious WMI activity. I need you to evaluate the telemetry for potential persistence mechanisms and generate a threat hunting summary. The output must include the Hunt ID, MITRE technique reference, target host, event category, consumer type, WQL query, executed command or script, assessed risk rating, and suggested remediation steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 During an endpoint hunt, you discover an active command line consumer. Before flagging it as malicious and removing it, what enterprise management software products should be cross-referenced as legitimate sources of WMI subscriptions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 During hunt documentation, an engineer recorded 'ActiveScriptEventConsumer' in the Consumer Type summary field. According to standard hunt report schemas, what shortened consumer classification string should be used in the Consumer Type field for script consumers?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Telemetry indicates a WMI event consumer designed to execute embedded VBScript code whenever system uptime exceeds 300 seconds. Classify this artifact under standard WMI event consumer type naming.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When running PowerShell queries to hunt for active permanent WMI event subscriptions across endpoints, tier-2 analysts typically check root\cimv2. Which specific WMI namespaces contain permanent WMI event subscription instances like filters and consumers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 An alert triggered for a newly created scheduled task executing PowerShell scripts on server SQL-DB-01 using schtasks.exe. Analyze this artifact and produce an investigation overview detailing the task trigger, task action, privilege level, and remediation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are configuring SIEM alert rules in Splunk for detecting WMI event filter creations (WmiEventFilter). System administrators suggest monitoring Sysmon Event ID 1 (Process Creation) or Event ID 11 (File Create). Which specific Sysmon event ID dedicated to WmiEventFilter creation should we filter for?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An incident response team extracted a WMI event consumer that executes a binary shell command upon system startup. What is the standard WMI event consumer classification for command-line payload execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Construct a threat hunt tracking identifier for a WMI persistence investigation conducted on May 15, 2024, sequence number 001, following standard incident report formatting rules.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 A security team planning to deploy Sysmon for WMI event logging (Event IDs 19, 20, 21) is checking minimum version requirements. What minimum Sysmon version is required to support WMI event logging?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When reviewing a WmiEventFilter instance during persistent event subscription hunting, where in the filter object structure do you inspect the trigger criteria (such as process start or timer events)?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +32 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 31.8%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 02:20 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run32

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.